Executive brief
dot is a lightweight JavaScript utility library for manipulating object properties. A prototype pollution vulnerability in the set() function could allow attackers to modify the shared Object.prototype, affecting all objects in an application and potentially causing unexpected behavior or enabling privilege escalation.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321, CWE-915) in the set() function of eivindfjeldstad-dot versions below 1.0.3. The function fails to sanitize the __proto__ payload when processing object paths, allowing an attacker to inject properties into Object.prototype. Since the vulnerable function is directly callable with untrusted input (likely network-reachable via Node.js applications), an attacker can craft a malicious path string to pollute the prototype chain. The fix, committed on 2020-02-22, adds validation to prevent __proto__ key pollution. No authentication or user interaction is required to trigger the vulnerability.
Affected products
- eivindfjeldstad dot below 1.0.3
Timeline
- 2020-04-06: disclosed
- 2020-02-22: patched: Fix committed; version 1.0.3 released
- 2021-05-25: advisory